diff --git a/.gitignore b/.gitignore index e908749..bac1052 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,4 @@ terraform.tfstate.backup terraform.tfvars .direnv .vscode +result diff --git a/dns.tf b/dns.tf index 2ab4975..b389c2c 100644 --- a/dns.tf +++ b/dns.tf @@ -14,6 +14,22 @@ resource "hetznerdns_record" "banditlair_hcloud_a" { ttl = 600 } +resource "hetznerdns_record" "backend1_a" { + zone_id = data.hetznerdns_zone.banditlair_zone.id + name = "backend1" + value = hcloud_server.backend1.ipv4_address + type = "A" + ttl = 600 +} + +resource "hetznerdns_record" "db1_a" { + zone_id = data.hetznerdns_zone.banditlair_zone.id + name = "db1" + value = hcloud_server.db1.ipv4_address + type = "A" + ttl = 600 +} + resource "hetznerdns_record" "banditlair_dedicated_a" { zone_id = data.hetznerdns_zone.banditlair_zone.id name = "*" diff --git a/flake.lock b/flake.lock index 284d70f..c4f85b4 100644 --- a/flake.lock +++ b/flake.lock @@ -1,12 +1,64 @@ { "nodes": { + "deploy-rs": { + "inputs": { + "flake-compat": "flake-compat", + "nixpkgs": "nixpkgs", + "utils": "utils" + }, + "locked": { + "lastModified": 1632822684, + "narHash": "sha256-lt7eayYmgsD5OQwpb1XYfHpxttn43bWo7G7hIJs+zJw=", + "owner": "serokell", + "repo": "deploy-rs", + "rev": "9a02de4373e0ec272d08a417b269a28ac8b961b4", + "type": "github" + }, + "original": { + "owner": "serokell", + "repo": "deploy-rs", + "type": "github" + } + }, + "flake-compat": { + "flake": false, + "locked": { + "lastModified": 1627913399, + "narHash": "sha256-hY8g6H2KFL8ownSiFeMOjwPC8P0ueXpCVEbxgda3pko=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "12c64ca55c1014cdc1b16ed5a804aa8576601ff2", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, "nixpkgs": { "locked": { - "lastModified": 1630248577, - "narHash": "sha256-9d/yq96TTrnF7qjA6wPYk+rYjWAXwfUmwk3qewezSeg=", + "lastModified": 1632086102, + "narHash": "sha256-wVTcf0UclFS+zHtfPToB13jIO7n0U9N50MuRbPjQViE=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "e0ce3c683ae677cf5aab597d645520cddd13392b", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixpkgs-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_2": { + "locked": { + "lastModified": 1637595801, + "narHash": "sha256-LkIMwVFKCuEqidaUdg8uxwpESAXjsPo4oCz3eJ7RaRw=", "owner": "nixos", "repo": "nixpkgs", - "rev": "8d8a28b47b7c41aeb4ad01a2bd8b7d26986c3512", + "rev": "263ef4cc4146c9fab808085487438c625d4426a9", "type": "github" }, "original": { @@ -18,7 +70,23 @@ }, "root": { "inputs": { - "nixpkgs": "nixpkgs" + "deploy-rs": "deploy-rs", + "nixpkgs": "nixpkgs_2" + } + }, + "utils": { + "locked": { + "lastModified": 1631561581, + "narHash": "sha256-3VQMV5zvxaVLvqqUrNz3iJelLw30mIVSfZmAaauM3dA=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "7e5bf3925f6fbdfaf50a2a7ca0be2879c4261d19", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" } } }, diff --git a/flake.nix b/flake.nix index 72da427..000e971 100644 --- a/flake.nix +++ b/flake.nix @@ -1,7 +1,8 @@ { inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; + inputs.deploy-rs.url = "github:serokell/deploy-rs"; - outputs = { self, nixpkgs }: + outputs = { self, nixpkgs, deploy-rs }: let pkgs = nixpkgs.legacyPackages.x86_64-linux; @@ -13,68 +14,89 @@ ]; }; in - { - devShell.x86_64-linux = pkgs.mkShell { - buildInputs = with pkgs; [ - nixpkgs-fmt - terraform - terraform-ls - sops + { + devShell.x86_64-linux = pkgs.mkShell { + buildInputs = with pkgs; [ + nixpkgs-fmt + terraform + terraform-ls + sops + deploy-rs.packages."x86_64-linux".deploy-rs + ]; + }; + + nixosConfigurations = { + db1 = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + modules = common.modules ++ [ + ./modules/postgresql.nix + ./modules/custom-backup-job.nix + ./modules/custom-backup-job.nix + ( + { + networking.hostName = "db1"; + networking.domain = "banditlair.com"; + networking.firewall.interfaces."enp7s0".allowedTCPPorts = [ 5432 ]; + services.custom-backup-job = { + additionalReadWritePaths = [ "/nix/var/data/postgresql" ]; + additionalPreHook = '' + ${pkgs.postgresql_12}/bin/pg_dump -U synapse synapse > /nix/var/data/postgresql/synapse.dmp + ${pkgs.postgresql_12}/bin/pg_dump -U nextcloud nextcloud > /nix/var/data/postgresql/nextcloud.dmp + ''; + startAt = "03:00"; + }; + system.stateVersion = "21.05"; + } + ) ]; }; + backend1 = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + modules = common.modules ++ [ + ./modules/nginx.nix + ./modules/murmur.nix + ./modules/synapse.nix + ./modules/nextcloud.nix + ./modules/custom-backup-job.nix + ( + { + networking.hostName = "backend1"; + networking.domain = "banditlair.com"; + networking.localCommands = "ip addr add 95.216.177.3/32 dev enp1s0"; + networking.firewall.allowedTCPPorts = [ 80 443 64738 ]; + networking.firewall.allowedUDPPorts = [ 64738 ]; + services.custom-backup-job = { + additionalPaths = [ "/var/lib/nextcloud/config" ]; + additionalReadWritePaths = [ "/nix/var/data/murmur" ]; + additionalPreHook = "cp /var/lib/murmur/murmur.sqlite /nix/var/data/murmur/murmur.sqlite"; + startAt = "03:30"; + }; + system.stateVersion = "21.05"; + } + ) + ]; + }; + }; - nixosConfigurations = { - db1 = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - modules = common.modules ++ [ - ./modules/postgresql.nix - ./modules/custom-backup-job.nix - ./modules/custom-backup-job.nix - ( - { - networking.hostName = "db1"; - networking.domain = "banditlair.com"; - networking.firewall.interfaces."enp7s0".allowedTCPPorts = [ 5432 ]; - services.custom-backup-job = { - additionalReadWritePaths = [ "/nix/var/data/postgresql" ]; - additionalPreHook = '' - ${pkgs.postgresql_12}/bin/pg_dump -U synapse synapse > /nix/var/data/postgresql/synapse.dmp - ${pkgs.postgresql_12}/bin/pg_dump -U nextcloud nextcloud > /nix/var/data/postgresql/nextcloud.dmp - ''; - startAt = "03:00"; - }; - system.stateVersion = "21.05"; - } - ) - ]; - }; - backend1 = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - modules = common.modules ++ [ - ./modules/nginx.nix - ./modules/murmur.nix - ./modules/synapse.nix - ./modules/nextcloud.nix - ./modules/custom-backup-job.nix - ( - { - networking.hostName = "backend1"; - networking.domain = "banditlair.com"; - networking.localCommands = "ip addr add 95.216.177.3/32 dev enp1s0"; - networking.firewall.allowedTCPPorts = [ 80 443 64738 ]; - networking.firewall.allowedUDPPorts = [ 64738 ]; - services.custom-backup-job = { - additionalPaths = [ "/var/lib/nextcloud/config" ]; - additionalReadWritePaths = [ "/nix/var/data/murmur" ]; - additionalPreHook = "cp /var/lib/murmur/murmur.sqlite /nix/var/data/murmur/murmur.sqlite"; - startAt = "03:30"; - }; - system.stateVersion = "21.05"; - } - ) - ]; + deploy.nodes = { + db1 = { + hostname = "db1.banditlair.com"; + profiles.system = { + user = "root"; + sshUser = "root"; + path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.db1; + }; + }; + backend1 = { + hostname = "backend1.banditlair.com"; + profiles.system = { + user = "root"; + sshUser = "root"; + path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.backend1; }; }; - }; + + checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib; + }; } diff --git a/modules/nextcloud.nix b/modules/nextcloud.nix index 31c534e..d777683 100644 --- a/modules/nextcloud.nix +++ b/modules/nextcloud.nix @@ -41,7 +41,7 @@ in services.nextcloud = { enable = true; - package = pkgs.nextcloud21; + package = pkgs.nextcloud22; hostName = "cloud.${config.networking.domain}"; config = { dbtype = "pgsql"; @@ -52,6 +52,7 @@ in adminpassFile = "/var/keys/nextcloud-admin-pass"; adminuser = "root"; overwriteProtocol = "https"; + defaultPhoneRegion = "BE"; }; }; users.users.nextcloud.extraGroups = [ "keys" ];